Keep candidate data in the EU
Candidate records, CVs and interview recordings are stored in the European Union, and text analysis is sent to an AI endpoint hosted in the EU rather than to an unspecified region. Transcripts are encrypted at rest, access follows workspace membership and permissions, and retention and deletion are settings you control. Review where each type of data lives, who can reach it and how long you keep it before you move live recruitment into any system.
Treat AI as a review aid, in line with the EU AI Act
The EU AI Act treats AI used to screen or rank people for a job as high-risk, and expects meaningful human oversight rather than an automated decision. Kadroflow is built that way on purpose: the AI summarises evidence and suggests, but rejecting, ranking and scoring a candidate automatically is refused, and interviewers record their own judgment before they see the AI's. A person remains responsible for every hiring decision.
Keep the evidence and the audit trail
Analysis is tied to the source: a claim the AI cannot support with a verbatim quote from the CV or transcript is dropped rather than shown. Each model run is recorded with its purpose and risk class, and the workspace can see where the team agreed or disagreed with the AI over time. Inputs derived from protected characteristics are deliberately excluded, so an advisory signal never becomes a hidden gate.
Evaluate the data handling before you commit
Compliance depends on how you configure and use the system, not only on the software. Take a synthetic candidate through the export and deletion paths, check what each role can see, and confirm your retention periods. Kadroflow is designed to support your obligations under the GDPR and the EU AI Act; it does not remove the need to review your own processing, records and candidate notices with the people responsible for them.
Questions before you start
Is Kadroflow a GDPR-compliant ATS?
Its data handling is designed for the GDPR: candidate data is stored in the EU, access is controlled by workspace and role, and export, retention and deletion are supported. Whether your use is compliant also depends on how you configure the workspace and what you tell candidates, so review it with whoever is responsible for data protection in your organization.
How does the EU AI Act apply to hiring software?
The EU AI Act classifies AI used for recruitment and candidate selection as high-risk. That calls for human oversight, transparency about when AI is used, and records of how it was used. Kadroflow keeps AI advisory, labels its output and records each run, so the human oversight the Act expects is part of the workflow rather than left to the reader.
Does the AI decide who to reject?
No. Rejecting, ranking and scoring a candidate automatically is refused in the system itself. The AI can summarise interview and CV evidence, but a person makes and records every decision and its job-related reason.
Where is candidate data processed?
In the European Union. Candidate records sit in an EU Postgres database, interview recordings are held in EU-pinned storage, and text analysis is sent to an AI endpoint in the EU. Speech transcription runs on the same processor that already holds the recordings, so interviews are not sent to an additional sub-processor.